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Introduction 


A system may be defined as a set of parts with the output of the whole greater than the sum of 
the output from the individual parts. The systems approach is considered to be a formal and 
systematic set of procedures for systems development. Within the systems approach, systems 
certification is defined as the result of an applied examination process devised to formally test 
and affirm that the system being inspected satisfies certain accepted criteria. If certification is 
achieved by a system, it indicates that the system should fit its intended purpose and that it 
meets specific requirements of reliability, safety and performance. 

Within the definition of a system, it is obvious that a system may contain a human 
component. However, it should be noted that only recently have there been formal 
acknowledgements that a system is made up of human and equipment components (e.g. in the 
military - U.S.A. DoDI 5000.2 February 1991 1 ; UK Defence Standard 00-25 dated July 
1989 2 , NATO STAN AG 3994 AI dated 1990-913). 

Human Factors (HF) certification should be an integral part of systems certification. HF 
certification implies that HF specification, testing and evaluation have a secure foundation; 
therefore, the process of certification follows as a matter of carefully progressed HF appraisal 
of the system. The final HF certification tests should be the culmination of a planned process of 
certification allowing orderly and conditional HF certification to be progressed throughout the 
duration of the project. HF certification is ultimately concerned with how efficiently the human 


1 DoDI 5000.2 defines a total system as including the humans that will operate and 
maintain the equipment. 

2 Defence Standard 00-25 states that " This Standard should be viewed as a permissive 
guideline, rather than a mandatory piece of technological law". A System is defined as: 

'A purposeful organisation of equipment (hardware and software), personnel and 
procedures all of which interact and thus influence each other to produce some 
specific result or goal/ 

3 STANAG 3994 AI. This ST AN AG does not define a system though its list of definitions strongly implies 
that the human is an integral part of an ‘advanced aircrew system’. 
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element(s) of a system can perform through their use of the system, and how human 
performance affects that system’s performance capabilities and the safe achievement of system 
related goals. 

Specification and certification of engineered systems can be conducted under any of several 
well documented and accepted methods. Further, HF analysis and measurement has attracted a 
great deal of attention since WWD and can also be reliably performed 4 . However, the human 
role in complex human-machine systems is recognised as becoming predominately one of 
supervision, understanding of problems, judgement, choice and decision making. Thus, the 
main emphasis of the contribution of the human to human-machine systems has changed in 
nature from physical to cognitive . 5 

If the human contribution is largely cognitive, the HF specification and certification of 
human complex interactions through complex systems should require a sound knowledge of 
human cognition. Applied knowledge of cognitive processes to the required quality does not 
currently exist in the realms of HF, engineering or psychology. Therefore, with such a gap in 
knowledge, any HF certification of complex or advanced aircrew systems must be carefully 
qualified. 


Cognition and Operation of Advanced Aircraft Systems 


Conceptual issues 

Engineering ideas are about as far removed conceptually from the ideas of human psychology 
as any ideas can be. This is because engineering ideas are mechanistic/physicalistic and based 
in the natural sciences 6 7 , whereas psychology can be termed the ‘Science of Mental Life, both of 
its phenomena and its conditions’ 7. Disciplines such as HF, Cognitive Psychology and 
Industrial Psychology attempt to bridge the conceptual gap. In addition, disciplines such as 
Engineering Psychology and Cognitive Engineering are attempting to adopt more teleological 
approaches to the appreciation of human work . 8 However, with the rapid advances in computer 
based systems and automation, and their burgeoning complexity, it appears that the conceptual 
gap still remains wide. To give examples from diverse HF viewpoints over the last decade, the 
following four quotes show a general HF/Psychological concern on engineering approaches to 
system design and automation, approaches that are biased to only considering observable 
manifestations of human behaviour. 


4 A good description of the methods generally used by ‘behavioural specialists’, including HF engineers, is 
contained in Meister (1985). 

5 Cognition is normally taken to refer to the part processes of the mind involved in human knowing such as 
reasoned thought, understanding and judgement. In contrast, mental or psychological processes are more global 
and cover the total remit of mind functions and processes including such as emotion and long term memory . 

6 Physicalistic taken as pertaining to the physical, mechanistic or the observable. A great deal of the tenets of 
HF and Psychology are founded on physicalistic approaches i.e. anthropometries, biomechanics, human manual 
control of systems, many approaches to HCI design, behaviourism to name but a few. 

7 Definition from James (1890). 

8 Teleology - as applied to the human refers to human mental goal seeking and purposeful behaviour. For an 
interesting and teleological associated discourse on paradigm shifts in science see Ackoff (1972). 
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i. ...Physicalistic descriptions can only capture those aspects of man which submit to the 
metaphor of the machine, and must fail to account for the rest. This inadequacy of the 
physicalistic approach becomes gradually more clear, as the complexity of man-machine 
systems increases. (Hollnagel, 1983) 

ii. . . . we are still making the same seemingly contradictory statement: a human being is a poor 
monitor, but that is what he or she ought to be doing. (Wiener, 1985) 

iii. ...the designer who tries to eliminate the operator still leaves the operator to do the tasks 
which the designer cannot think how to automate. (Bainbridge, 1987) 

iv. Is it possible that our advanced command and control systems will require cognitive human 
performance that defies our ability to measure and predict? ... What none of the existing models 
are much good at is analysis of cognitive behaviour. (Miles, 1993) 9 


Problems in the Appreciation of Unobservable ‘Mental Life’ 

The greater the complexity of a human-machine system, the greater the problems in efficiently 
integrating the human component into the system. With a complex system, the human may 
have difficulties in maintaining a concept of system performance and fitting that concept to the 
human role within the system. Such difficulties may not only exacerbate problems that the 
human finds in system control or supervision but may also encourage the human to enter 
incorrect or inappropriate inputs into the system. Therefore, the human performance at the 
human-machine interface (HMI) of a complex system must be assisted in an attempt to ensure 
that situational awareness 10 is sustained, the human is aided in the obviation of human system 
related 'errors', 11 is helped to skillfully maintain a necessary defined role within the system, 
and is neither overworked nor bored. 

There are innumerable HF standards and guidelines on how to define and certify simple 
systems. These standards and guidelines are normally advisory and invariably stress the 
physical aspects of systems and/or the use of empirical evidence. They mimic the form of 
system specification in that components of a system are specified by their physical or manifest 
functions and the logical interrelationships of these functions. 

However, the human catalogue of skills transcends the physical, 12 especially when the 
human has to cope with complexity and uncertainty. Cognition is hidden and may be either 
abstract or have manifestations in observable human activity. Thus, the processes of human 


9 Miles, J.L. (1993). TASK Analysis - Foundation for Modem Technology presented at MRC Workshop on 
Task Analysis, University of Warwick, U.K. 

10 Situational awareness refers to an understanding of all the factors affecting mission performance, including 
the status of the aircraft and its mission system, and the tactical, spatial and the geographical environment 
external to the aircraft. See Taylor (1993). An older, higher level concept used by UK aviators was termed 
‘Airmanship’. 

1 1 Human system related errors could be operator, maintainer or designer based or be based on a combination of 
all the 3. For consideration on error forms see (Rasmussen (1986), Reason (1990)). 

12 As an example, Welford (1976) identified three types of human skill as: 

Perceptual - The skills that code and interpret incoming sensory information; 

Motor - The skills associated with skilled movement but controlled by perception and cognition; 
Intellectual or Cognitive - skills considered by Welford to be the most important as they link 
perception and action through decision processes. 
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judgement are also hidden. For example, the human assessment and judgement of the quality of 
equipment related information might be a continual background task with no directly associated 
manifest actions on the part of the equipment observer. However, if the observer’s judgement 
leads to choice, and the choice requires action, an observable human activity will result. 
Therefore, physicalistic system functions may or may not have an equivalence within the 
cognitive functions of the human component of the system. 

Moreover, physical systems are constructed by logical rules of engineering while human 
logic is dependent on gleaned knowledge, human mental functions and heuristics that are based 
on aeons of human evolution. Training and experience can tune human abilities into skills with 
respect to the human role within a system. Training cannot mould a human into a metaphor of 
an engineered system component. Thus, the overall system must be built to consider the 
possible contributions of human and machine, to allow one to complement and appreciate the 
capabilities and system inputs of the other. 

Traditional functionality. Traditional systems engineering stresses that the concept of design 
must be based upon a detailed understanding of the functionality of the system. 

Functional analysis requires specifying function in the abstract. The very fact that a 
design is undertaken presumes an engineering concept and in turn a fairly limited 
range of engineering solutions. (Price, 1988) 

Thus, the transposition of engineering functions into required equipment performance is 
brought about by design based on a choice from a limited range of solutions. However, the 
manifestation of performance by the human depends on the individual human’s innate mental 
abilities, developed physical and cognitive skills, the existing level of fatigue, and personal and 
organisational mores and ambitions, to name but a few influences. Underlying that human 
performance, human cognitive functions rely on human mental processes and are related to 
human progress towards goals 13 through the use of tools. They may or may not be associated 
to the parallel performance of certain equipment functions within an engineered system as 
suggested by the traditional approach. They may however be part of system processes that 
encompass both engineered and human system functions. Two examples are given as 
indicators of the problems inherent in using traditional physicalistic approaches to the 
conception of human machine systems: 

Example One. An aircraft is flying from one airfield to another. During the flight a system 
subset might be performing an automatic navigation calculation to update aircraft positional 
information in parallel to a pilot’s radio communication to inquire on the weather at the 
destination airfield. The equipment will be working to a fixed schedule whereas the pilot 
inquiry might be prompted by an observation that present position weather is different from that 
forecast or by his detection of a similar inquiry from another aircraft with respect to an airfield 
adjacent to the destination. 

The two activities are related by the overall purpose of the flight but are not necessarily 
performed in parallel. Indeed, the subject communication activity might not take place on every 
flight. The automatic equipment calculation is deterministic whereas the pilot’s communication 
mainly depends on the vagaries of the weather and the performance of the pilot. 


13 Goal can be defined as the end result towards which a mental or physical effort is directed. Goal can also be 
descibed as an objective towards which the individual consciously or unconsciously strives (Adler (1929)). 
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The pilot’s human function allows him to decide on the form of his work with relation to 
prevailing circumstances regardless of his assigned system function. However, the machine is 
unaware of the flying environment apart from that environment’s influences on the navigation 
calculations. Here a system related problem may arise from both the differences and possible 
divergences in the short term goals of the human and machine. Traditionally the human inputs 
information and direction to the aircraft systems to bridge the differences. 

From this example there are unlikely to be repercussions critical to the safe completion of the 
flight. However, it is only a simple example. With a complex human-machine system the 
question should be raised on how much and when man/machine compatibility in roles is to be 
ensured, both from the machine and human standpoints. 

Example Two. Task analysis is a form of predictive analysis used for the consideration of 
human tasks with relation to the operation of a system towards system related goals. However, 
this predictive modelling and analyses is usually based on engineering related functionality and 
is thus biased towards the observable aspects of human performance ignoring such as 
judgement, understanding and choice (two examples of such analyses are Operational Sequence 
Diagrams (OSDs) and Hierarchical Task Analysis (HTA)). 

However, task analysis is concerned with the analysis of human tasks. Human tasks require 
the human to apply both cognitive and physical effort. This effort is needed to direct a system 
towards the achievement of preconceived goals both tactical and strategic (Tactical and strategic 
goals will be discussed in more detail in Section 4 below). The problem aired here is that not all 
human tasks can be considered and analysed if only mechanistic based or observable tasks are 
considered. 


Traditional approach to HMI. The study of HMI, this encompassing Human Computer 
Interfaces (HCI), is also supposed to consider the amalgam of human and machine system 
components. However, what an HMI normally shows is an interface design tuned to foreseen 
needs for the human to equate to the engineered functionality of the equipment. Only recently 
have there been any signs of a consideration under certain applications to the cognitive needs 
and abilities of the human operator/maintainer (e.g. Macintosh and Windows WIMP in 
’Desktop Metaphore’). However, the concept still appears one way, that the human has to 
appreciate the machine. 

There are many HMI and HCI design paradigms in existence but they will not be further 
considered here. As an aside, prototyping is meant to be an exercise where an HMI or HCI can 
be demonstrated and tuned to obtain the optimum interface between the machine and the human 
for a particular application. In reality, HMI prototyping with advanced aircrew systems is 
frequently used only an exercise of demonstration and not as an analysis of the man machine 
system performance capability allowed by the HMI. 

Consolidation . To reiterate, the human may be considered a complementary part of an 
engineered system, but not as a piece of equipment that can be easily specified. The traditional 
partitioning of system functionality to allocate functions to humans and machine so that each 
performed the most appropriate (machines are better at/human are better at) 14 assumed that 
physicalistic system functionality could be directly transposed to either human or machine . In 
defence of the traditional approach, developments on the theme considered the complementary 


14 Originating in the work by Colonel Fitts. 
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nature of human and machine in a system and acknowledged that some functions could be 
performed by either with equal efficiency. 

Indeed, the simple physicalistic transposition of functions to human or machine may have 
held true in situations where human used machines as tools to be directly applied to work 
performed under immediate human attention. However, the subject transposition is much less 
likely to be true where human work through complex systems towards mission goals 15 , where 
direct allocation of numerous system functions to the humans or the machine becomes more 
difficult to determine at anything but the highest level of consideration and, finally, when 
human work is based more on human cognitive performance than on psychomotor 
performance. 

There appears to be a gradual realisation, especially in the U.S.A., that the standards and 
guidelines produced in the early 1980s are set in the physicalistic engineering mores of the 
1970s. In the 1970s and early 1980s systems were less complex and the human was generally 
closely involved in operating directly with systems to achieve goals (often in a one to one 
relationship as in the use of a computer based word processor application) rather than the 
current push to operate through systems to meet goals (as with an airborne mission system 
where the tactical performance of the aircraft is directed by the operator through an HCI 
updated from advanced navigation, communication and sensor equipment). 

As already suggested, one of the problems with the drive to automation with airborne 
systems is that the human has been forced, in many instances, out of the primary role of a 
system operator and into the primary role of system supervisor, this without the development 
of tools to assist in the performance of the new role (or even a determination that the new role is 
suited). Many studies have shown that automation may have decreased the occurrence of 
certain error forms but has introduced new categories of man-machine system error that have 
yet to be fully understood (Weiner op cit, Woods & Roth (1988)). 

Advanced systems are being designed forgetting the underlying tenet of systems design - 
that the whole is greater than the sum of the parts. The human and machine components of a 
system must complement and assist each other within the system. It is not fruitful to enhance 
the speed in which a system can operate if the quality of system support to the human decision 
processes is impaired. 

Thus, it follows that an underlying contention of this paper is that the new forms of complex 
system operating problems and errors tend to be cognitive rather than psychomotor based. Also 
that new forms of errors should be considered to be mainly dependent on the achieved efficacy 
of human machine system design rather than as mainly resident with the human operator of the 
system. 


Problems Inherent in HF Specification with Traditional Systems Design 

The problems inherent in HF specification with traditional systems design will be illustrated 
using examples from two well known standards. 

Traditional design by Def Stan 00-25. Systems design and development rely on a traditional 
series of analyses through system planning and preliminary design to detailed design and 
development. The initial system requirement analysis is usually conducted by the customer and 
considers such needs as system purpose, sphere of operations, types of system components. 


I 5 For a discussion of goals in aircraft missions see Taylor (1993). 
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system reliability to name but a few. This initial requirement is stated at a high level. The 
system requirements analysis is the basis of the specification that initiates the system process. 

Figure 1 shows the UK Def Stan 00-25 model of HF activities conducted during system 
design. In Figure 1, it can be seen that it is presumed that an allocation of system functions can 
be performed in the traditional manner. Of interest, the particular UK concept of Task 
Synthesis entails: 

...the design team, using their judgement and expertise, proposing a combination or 
sequence of tasks appropriate to the function. (Def Stan 00-25, Part 12, pi 4) 



Figure 1 . Human Factor Activities Conducted During System Design 
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Note that the previous forms of analyses on which the Task Synthesis is based are wholly 
physicalistic and conceive that: 

"The major system requirements are physical. . .but there are always explicit behavioral 
requirements." (op. cit. pi 1) 


Design by STANAG 3994 . In STANAG 3994AI the problems inherent in straight physicalistic 
function allocation to the human are recognised in that a ‘Potential Operator Capability 
Analysis’ is mooted alongside analyses of human ‘Decision’, ‘Error’, ‘Information 
Requirements’ and ‘Control Requirements’. Indeed, the Task Analysis mooted explicitly 
covers human cognition as it states that the analyses: 

...shall show the sequential and simultaneous manual and cognitive activities of the 
operators/maintainers, and include those aspects of their tasks which involve planning 
and maintaining situational awareness, as well as decision making and control 
activities. (p4) 

However, the task analysis is to be based on preceding analysis. The emphasis of the 
preceding analyses is still seen as placing an over reliance on physicalistic functionality. From 
the descriptions of the preceding analyses, there appears to be an underlying assumption that a 
form of mapping can be made from the systems functionality of ‘Advanced Aircrew Systems’ 
onto human functionality within the system and the associated human cognitive processes. To 
give an example of difficulty in such mapping, the STANAG example of Function 16 (e.g. 
control air- vehicle) is decomposed under ‘Function Analysis’ through - 

...successive levels of detail to a point where individual functions can be 
unambiguously identified, prior to allocation to human, hardware, or software system 
components. 

It has already been argued above that ‘Function’ is an engineering concept within systems 
engineering and that human and engineering functions differ. Therefore, from that conceptual 
base it can be conceived that human mental facets such as human understanding, judgement and 
choice cannot be easily mapped onto a system function such as ‘control air-vehicle’ This is true 
especially as many complex system control functions must be hidden to the operator and much 
of human cognitive processes must be governed by factors such as previous human training, 
experience, the effects of the flying environment and immutable human heuristics. 17 

Nevertheless, though the STANAG concept of ‘Function Allocation’ still mainly relies on 
the assumption that physicalistic functions can be mapped into human functions, it is strongly 
influenced by “...the review of potential operator capabilities” (p3). It is suggested that, in 
reality, some of the ‘human’ human-machine functions requiring consideration might emanate 
solely from the ‘Potential Operator Capability Analysis’ area, especially through a review of 
operator tasks in similar systems. Importantly, it needs to be recognised that some essential 


16 Function - A broad category of activity performed by a system, usually expressed as a verb + noun phrase 
e.g. control air- vehicle, update way-point. 

17 Some basic fundamental characteristics of human cognition that appear to be common to all humans. See 
Tversky, A. and Kahneman, D. (1974). 
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human-machine system functions can be purely cognitive, albeit open to influence from human 
understanding on the significance of information available from the pertinent man machine 
system or other sources. 

Figure 2 below gives an indication of the initial analyses required by the STANAG 3994. 



Figure 2. STANAG 3994 General Model for Early Human Engineering Programme 

From the considerations above, an improved high level definition of a human-machine 
system can be presented: 

A man machine system is a complex system that works towards the achievement of 
specified goals using the dynamic application of the diverse capabilities of that system, 
assisted by a cognitively directed human and equipment effort, to create an expected 
system performance. 

Fully automated systems beyond the realms of human ken 18 are not considered by this 
paper. The design of complex systems require that an adequate degree of human work related 
understanding, judgement and choice exists if optimum human decision processes are to be 
considered at a system working level. Indeed, effective human-machine systems design 


18 Ken - an old Scottish word meaning understanding within current knowledge or sight. 
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requires a recognition of both optimum and sub optimum human work processes in order to 
appreciate and conceive safe and efficient system operation throughout the range of possible 
human abilities and skills. 

To reiterate. 

It needs to be recognised that some essential human-machine system functions can be 
purely cognitive . 

Thus, it is necessary that better consideration is given to the important role of human 
cognition within human-machine systems during the specification of advanced aircrew 
systems. Before attempting to further advance such a consideration, it is first sensible to have a 
more detailed appraisal of some of the extant components of the system design process, and 
methods of their classification, starting with system functionality. 19 

System functionality. The specification of system functionality delineates the span of system 
capability and is one of the fundamentals of the traditional system approach to design. 
Functionality is based on a knowledge of intended system purpose, usage, the technology 
available, previous like systems (if any), and the level of human behavioral involvement with 
system operation. 

Regardless, there must be a method of classifying the importance of functions. One method 
is to classify functions as either as Necessary or Accessory 20 * Whilst this classification method 
should be useful regardless of the nature of the functionality examined, traditionally, systems 
design only considers tangible physical 21 functions. 

Of interest, the Necessary/Accessory functional classification may appear to map 
conveniently onto the standard UK MoD specification of system features as ‘Essential’ or 
‘Desirable’. However, “Essential/Desirable” are indications of the MoD priority on 
requirements and may or may not be associated with considerations on the criticality of the 
feature with respect to the achievement of mission success. 

It has already been argued that the physicalistic functionality required by a system cannot be 
simply or easily mapped across to the functionality pertinent to the operation of the human 
component of the system. For advanced and complex aircraft systems, it is important that a 
method be devised of classifying functionality from several standpoints: the physicalistic or 
equipment standpoint; the standpoint of the human cognitive component; the standpoint of 
amalgamated equipment and cognitive system components, etc. 

However, one improved approach to functionality classification verges on the recognition of 
the prime importance of human knowledge and cognition was mooted by Price (1985) in his 


19 It has been argued to this point that the abstract concept of functionality used for systems design has a 
physicalistic, engineering or empirical bias. This is historic in origin and is still the usual concept of 
functionality (See Ackoff op. cit.). However, functionality can be categorised in many alternative ways 
including ‘Material or Informational’, ‘Necessary or Accessory’ (Price (1985)). It is argued here that for an 
advanced or complex system it can also be categorised as ‘Cognitive, Equipment or a combination of both’. 

20 Necessary functions are functions that are deemed to be essential to allow a system to successfully meet its 
goal(s). Absence or failure of a necessary function will result in a failure to meet the system goal(s). Accessory 
functions provide system redundancy, allow alternative paths to task completion or add capabilities that enhance 
the system. The failure of an accessory function is not critical to the successful performance of a system. 

21 It could be argued that if anything is tangible it can be considered under material functionality. However, 
this is not the case in the consideration of material functionality as it attends to things both tangible and 
physical with relation to a system. For example ‘fear’ is sometimes described by individuals as tangible, may be 
related to a system operation but is not physically part of a system. 
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classification of Material and Informational functionality. Material functionality is seen as 
purely physicalistic and refers to traditional system engineered or equipment functionality. 
Depending on the intent of the particular study this functionality can be generic or specific to an 
adopted equipment. 

Informational functionality. Informational functionality concerns information that is associated 
with the system usage of physicalistic functionality. Thus, informational functionality is closely 
associated with material functionality. As an example, an informational function might be ‘plan 
drop weapon’ and has a direct material equivalent of ‘drop weapon’. 

Nevertheless, there may not necessarily be an obvious direct link between informational and 
material function. For example, the informational function of ‘consider weather effects on 
Radar’ has no direct material equivalent as humans cannot as yet dictate the weather and the 
material Radar functionality that could be related is diverse (e.g. adjust Radar picture, adjust 
Radar scanner tilt, switch off Radar, inform crew of Radar effects, etc.). Any departure from 
the basic ‘verb+noun phrase’ defining informational functionality leads to difficulties in 
determining the equivalent material functionality. Therefore, it should be questioned as to 
whether this direct matching is of any use to determining the total functionality needed for an 
advanced or complex aircraft system. 

The traditional answer to the preceding question would be to the affirmative as the high level 
function ‘plan drop weapon’ might be decomposed into several sub functions such as ‘plan 
select weapon’, ‘plan open bomb doors’, ‘determine time to warn crew of attack’ etc. Again, 
however, the traditional approach would be to only consider the informational functionality 
directly associated with a material function or functions of ‘drop weapon’. 

Consideration of more complex functions highlights some of the application problems with 
the ‘ Material/Inf ormational’ classification. More complex functions such as ‘choose best 
weapon and attack tactic’ are obviously an amalgam of material, informational and cognitive 
functions with the cognitive being paramount. Such functions can also suggest processes at 
work: the threads, information flows and controls that tie functions together and give them 
meaning within system operation and performance. 

However, a function such as ‘question evidence’ is essentially cognitive and may be 
prompted by human knowledge and experience rather than the by the physical evidence 
presented by a system. This latter function cannot be described as informational as there is no 
obvious association with a material function. Thus, the traditional informational approach must 
be questioned as only in the case of simple material functionality (such as ‘lower seat height’) is 
there likely to be near direct associations of informational functionality. 

Still considering the example of ‘drop weapon’, in reality the associated human-machine 
related functionality is likely to be vast and could involve such as a cognitive association of 
information considering aircraft performance (height, speed and attitude), an assessment of 
target performance (speed, aspect height, manoeuvre), a recollection of given ‘Rules of 
Engagement’, an awareness of positions of ‘friendly’ forces that may be at risk, an appreciation 
of aircraft stores remaining, to name but a few possibilities. Therefore, it is argued that the 
above attempt to break the physicalistic description of functionality into its material and 
associated informational components is still engineering associated and would require a 
redefinition to allow it to fully consider human cognition within a human-machine system. 

Some attempts have been made through Knowledge Engineering to encapsulate human 
cognitive functions within the materialistic functionality of advanced aircrew computer based 
systems. It is beyond the remit of this paper to consider whether Knowledge Engineering can 
successfully capture complex human cognitive based expertise, and then usefully incorporate 
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that expertise as system related functionality within a dynamic and advanced aircrew system. 
Nevertheless, to be truly successful any such attempts must explicitly recognise human 
expertise and the importance of human cognitive functions to the operation of a man machine 
system. 

Summary of the assessment of functionality. It has already been argued that much of the 
physicalistic functionality associated with a complex system has no obviously associated 
human equivalent as the processes of cognition are hidden and may result in no visible human 
action or system input. Further, in aircraft systems there are important sustainers of human 
situational awareness that are not specific to system design but that are important to system 
performance. Such sustainers may be forgotten to the detriment of aircraft operation if an 
advanced aviation system design was to be purely based on the physicalistic or material 
approach. These include, but are not limited to, environmental/system associations such as 
arise from changes to such as ambient noise, vibration, or visual sightings. Indeed, sometimes 
the meaningful indicator is an absence of system derived information when the information has 
been determined by other means and should be present. Finally: 

Much is yet to be done, especially in analysing human cognitive requirements in 
working with automated machines and in putting a methodology into effect that will 
bring humans and machines systematically together to do those things that each can do 
best and that they can accomplish jointly to improve system performance. (Price, 
1985) 

Performance . Performance is the manifest result of the work undertaken by a system. A 
system is designed to achieve a particular quality/level of performance and in reality achieves a 
standard of performance that is seldom truly equivalent to that aimed for by the design. 
Predicted system standard of performance is determined by the designed amalgam of desired 
system functionality and, sometimes, a planned capability of the human component within the 
system. In reality, the achieved standard of performance is mediated by the environment, the 
achievable performance of the designed system, system reliability and actual human standard of 
performance as allowed through the use of the system and by influences external to the system. 
The human ultimately directs advanced aircrew system performance. System performance 
cannot be fully addressed unless the functionality and expected performance of the human 
component of the system is considered, this alongside equipment performance during the 
process of system analysis and design. 

Traditions of Enforced Compromise. Traditionally, the performance of complex airborne 
systems has been inferior to that predicted, a compromise has been accepted and the system has 
only reached the desired standards after an introduction of system enhancements introduced 
some time after the introduction of the system into operation. Extrapolation of past practices 
suggests that the more complex the system the longer it will take to bring an inferior system 
performance up to the level of expected or acceptable performance. In the military there are 
several advanced systems where the latter point has been borne out (they are known but should 
not be aired too much in public). 

The solutions applied to the introduction of systems that are obviously inferior to the 
requirement appear to be selected from one or more of the following: 

1) Compromise and accept the system as better than previous systems, 
(‘do what you are told route’)- 
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2) Compromise and accept the system limitations until time/finances can be found to 
improve the system, (‘traditional route often involving an expected mid-life update even 
before the initial system delivery*). 

3) Compromise and increase the number of personnel operating the system, 
(‘throw manpower at the problem - the serfdom route’). 

4) Compromise by expanding the training programme and improving the 
quality/experience of personnel employed with the system (expensive, but can be 
blamed on the quality of the personnel available in the past, or past mistakes in 
recruitment or on the ‘needed’ complexity of the system ). 

Methods outside the traditional compromises. 

5) Reappraise the design method. Ensure that the next system is designed using the 
‘lessons learned’ (a form of reappraisal of design method should always happen after 
any system design). 

6) Immediately cancel the production of the system (a final and shameful resort with 
blame attributed where and when possible and probably an obfuscation of any lessons 
to be learned). 

7) Develop and apply suitable methods for specifying and certifying the design and build 
of advanced aircrew systems (this depends on a realisation that current methodologies 
are inadequate and the existence of a will to improve). 

Of the mooted seven solutions given above, the first four compromises have been in 
existence for decades, the fifth solution is what is needed now and in the future to prevent the 
recurrence of expensive failures and the sixth has certainly been evoked recently (several 
programmes in the U.S.A. and UK spring to mind). The seventh is obviously the ideal. Of 
course, certain necessary compromises or ‘trade-offs’ should be inherent in design and should 
not be decried. 


Design 

Comprehensive and efficient design is the key to the achievement of required performance from 
complex systems but depends on the standard of system specification. Design is the bridge 
between system specification and the achieved system performance. This paper has argued that 
complex system design have traditionally considered the human in the physicalistic/ 
mechanicalistic sense. 

Until recently , the problems associated with the parallel needs of promoting human 
understanding alongside system operation and direction were generally equated by the natural 
flexibility and adaptability of human skills . However, the information rates and complexity of 
modem systems often place system processes beyond the supervisory or manipulative 
capabilities of the human, because human cognitive attributes and performance have not been 
properly considered within the design of the system. Where human cognition has been 
considered it is normally only where the concept of human cognition has parallels into the 
physicalistic mould of determining material functionality. 

The next section will consider the actual specification produced for the RN Merlin helicopter 
and discuss some of the lessons learned from that specification’s consideration on system 
functionality. 
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Functionality specification for the RN Merlin helicopter 

The emphasis of this paper is on the consideration of system functionality and its influence on 
the processes of HF certification. The overall specification process for the Merlin helicopter is 
presented in greater detail in the paper of Taylor & MacLeod (1993). 

The definition of Merlin functionality constituted one of the three parts created for the Merlin 
specification exercise. The functionality document was termed the Functional Requirements 
Definition (FRD). 


Functional Requirements Definition of Merlin Specification 

The (FRD) considered system functionality for the Merlin, as 

Functionality is not solely derived from the definition of the requirements for the 
individual systems and their interaction, ...those systems interact with the crew and 
systems outside the remit of Merlin, and the operational environment in which they are 
to operate. (MPC Specification 1990) 

Primary and secondary objectives were used to consider functionality. 

Primary Objective - To define the minimum acceptable functionality for the Merlin. This 
involved specifying the functionality for existing and new systems. The functionality 
considered here was material functionality. Thus, considering the existing equipment: 

. ..a set of ‘Major Functions’ were identified. To allow the current documentation set 
to be as effective as possible, the Major Functions are chosen to be approximately 
equivalent to the systems fitted to the current helicopter [EH101] and are therefore not 
intended to be a ‘pure’ functional breakdown from operational requirements. (MPC 
1990) 

Secondary Objective - System management functions fundamental to the successful integration 
of all systems on board Merlin. System management is defined as: 

The usage of the Merlin’s System through the tools devised from the amalgam of Human 
Engineering and other engineering approaches to the system design. (MPC 1990) 

The management areas were considered as Flight, Tactical and Maintenance. The three 
management functions, and specific Sensor functions, define the parameters that are to be 
displayed to the crew and the controls necessary to influence the operation of the Merlin. 
However, the interdependency between the management areas was not addressed in any detail. 
Flight and Tactical management were split into the following subsets 

Mission Management 

Those functions necessary to permit procedures and equipment to be employed that assist the 
crew in conducting the tasks required of Merlin. 
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Information Management 

Those functions necessary for the collation and processing of data to determine a future flight 
path or for the collation and processing of a tactical picture. 

Human-Machine Interface Management 

Those functions necessary for display of the tactical picture and system/equipment status, and 
crew interaction with the tactical picture. 

Sensor Management 

Those functions necessary to control the operation of the various related sensor functions in a 
consistent manner. 

It can be seen that under this form of functionality classification there was an effort to 
consider the functions that the crew would have to perform to manage the specified material 
functionality of the Merlin within, but not between, each of the three defined management 
areas. However, there is a potential pitfall with the focus on the human component of the 
system as a manager. Firstly, team work does not depend solely on good management but on a 
myriad of influences. Further, by definition, managers supervise and administer the resources 
available to them. A manager does not necessarily lead but directs resources within certain 
specified rules . In contrast, a leader does not necessarily need to manage, but guides others 
using such as foresight and tactics as well as resources. Indeed, the leader’s used resources 
may be beyond those immediately available and may not necessarily be closely governed by 
rules. 

In the Merlin case, the rules applied to the appreciation of system management failed to 
consider the system as a whole and thus restricted the scope of the given Secondary Objective . 
It is a matter of conjecture as to how efficiently the system might support leadership. However, 
the lack of a whole system appreciation on system management must raise a question on the 
efficacy of the aid that the resulting system will offer to the leader or to the system manager. 

To summarise on the management of real time complex systems. Firstly, a human is 
basically a poor supervisor. If the human is not involved in the operation of the system, the 
human’s attention and reactions to system cues are liable to suffer. Moreover, if the human 
functionality within a system is not fully specified it will be difficult to properly managed 
within the designed remit of the system. At the worst, the human resource is then managed in a 
Procrustean manner to fit into the machine design and may become involved in an incessant 
combat with the machine in order to achieve system goals. 

However, particularly with consideration on information management, there was some 
consideration on the human cognition requirements for the management of the Merlin systems. 
Examples are: 

The symbology used to represent information displayed to the crew shall be developed 
in accordance with human engineering principles given in chapter... to take account of 
the cabin and cockpit environment and human understanding. 

Classification also depends on human understanding of presented data. Aspects of 
this process shall be evaluated as part of the Human Engineering Programme Plan. 
(MPC 1990) 
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Nevertheless, the main source of management functions did reside in the material 
functionality of the aircraft equipment. This was partly because the definition of the ‘Major 
Functions’ was mainly determined by the existence of equipment already adopted for the 
helicopter during earlier development. It was also caused by a lack of in-depth consideration 
on extant maritime tactics or on future possible tactics for the aircraft. The particular reasons 
for this will not be discussed here. However, the result is that the requirements of possible 
tactical performance cannot be fully equated with the existing equipment functionality. 

Thus the problems associated with a necessary task related judgements and direction 
through human cognition at the human machine system interface could not be fully addressed. 
For this reason, much of the functionality that could have been ascribed to human mental 
properties was instead placed for consideration within the responsibility of the Human 
Engineering Programme Plan (HEPP), a plan which had to be constructed under the mandate 
of the already discussed STANAG 3994. 


HEPP and Design Requirements 

The application of Human Engineering to the Merlin system is governed by a mandated and 
agreed HEPP. Human Engineering placed emphasis on the human component of the system 
and introduced a planned approach to this aspect of the Merlin’s design, in order that important 
facets were recognised and addressed. 

Because of the already designed equipment, the HEPP and other design requirements were 
mandated too “late in the day” to be as effective as they might have been if they had been in 
existence from the onset of the system analysis and design process. Moreover, the Merlin 
specification was not created under the full remit of the STANAG 3994, though the STANAG 
was mandated by the completed specification. Therefore, some of the STANAG’s 
recommended system analyses were not fully considered in the specification including ‘Mission 
Analysis’ and ‘Potential Operator Capability Analysis’. 

However, for the new aircraft equipment, and hopefully for consideration of the integration 
of human performance within systems operations, the HEPP serves as a valuable aid for 
indicating areas of the system where improvements may have to be made or new procedures 
devised. Of course, before the system can be accepted into RN service it must pass a formal 
Operational Performance and Acceptance phase (OP AS) without a need for too much 
compromise. The HEPP is one of many ways of assessing the risk of successfully completing 
the OPAS. 

Moreover, the HEPP is based on the FRD and Design Requirements. The problems with 
the method of the FRD specification of requirements have already been discussed. Therefore, 
with some system analyses already conducted, the biases of the analyses are bound to be 
reflected in the performance of the HEPP. As the HEPP is also concerned with HF acceptance 
of all forms of HF analysis, tests and trials, any HF certification of the Merlin system should 
bear in mind the initial problems of specification. 


Discussion 

The RN Merlin was respecified as a system many years after the onset of the initial design 
process for the helicopter. However, the respecification process allowed the remaining aircraft 
development process to be defined both with relation to the expected aircraft system 
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performance and the possible risks associated with meeting the OPAS performance 
requirements. Throughout the HEPP, the HF input to design and the aircraft certification 
process has been stated with appropriate qualifications. This makes clear the process and 
requirements of HF certification . 

The important HF lessons learnt from the specification work were: 

To be fully effective, a HEPP should be produced and started early in the systems 
analysis process . 

It is obvious that more care has to be taken in the consideration of human cognition 
with respect to the design of a man machine system, especially where cognition may 
have specialised functions within the human-machine system. 

The omissions in the specification with relation to human cognition must represent a 
source of unspecified risk within the process of HF Certification. 

Through the above arguments, it can be reiterated that appreciation of human cognition is an 
important facet of complex man machine specification and, ultimately, certification. A possible 
method for the consideration of cognition during system analysis and specification will be 
outlined next. In part, the method is a development on areas of STANAG 3994. 


The Incorporation of Human Tactics and Strategies 


Introduction 

A tactic is defined as an arrangement or plan formed to achieve some short term goal. The goal 
may be an end in itself or serve as a stage in the progress towards a later objective. A strategy 
governs the use of tactics for the fulfilment of an overall or long term plan. Tactics can be 
formal written procedures or reside in human mental processes. Normally the human tactic 
selectively directs the formal system related procedural tactic. 

Human tactics and strategies are not only physicalistic, they are mental. 22 - A tactic is 
procedural, may be mainly skill based and is flexible and adaptable to a changing environment. 
In a human-machine system, the performance of tactics and strategies is enhanced by system 
equipment designed to aid the human to interpret information contained in the working 
environment and, also, to survive in that environment. Strategies allow the human to be 
selective in the use of tactics, to choose the most effective or most expedient for the fulfilment 
of the foreseen plan. 

The human perceives the world through information gleaned from the senses. This 
perception can be achieved through direct observation of the world or through the use of a 


Explanation of the human usage of a mental model of the world have been given by many researchers from 
various viewpoints and considering many possible constituent parts (cognitive maps, schemas, frames, scripts, 
goals, plans and schemes to name but a few). The use of ‘tactic’ and ‘strategy’ in this paper is for the sake of 
explanation and is not intended to supplant what has gone before but to aid in the current exposition. The terms 
are used here as they conveniently afford a mirror of cognitive activity onto related aircrew operating procedures 
(which can be broken down to tactics and strategies in the militaristic sense). Reference is given to Adler 
(1929), Bartlett (1932), Craik (1943), Schank et al (1975), Neisser (1976) and Card et al (1983) to name but a 
few. 
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human-machine system’s interface with the world. The perceived information is interpreted 
through the use of knowledge, rule and skill based mental and cognitive processes 23 that may 
vary between humans. The use of the interpreted information is then governed by human tactics 
and strategies. These tactics and strategies are tuned through training and experience and are 
governed by the human role within a human machine system and the human’s interpretation of 
that role. The results of human tactics and strategies are manifest in observable human 
performance and skills. 

Therefore, tactics and strategies are continually mediated by both the information that the 
operator already possesses and information gleaned from the working environment. In the 
performance of work, the former information is purely human in origin and influences the latter 
whilst the latter is often human-machine in origin and can eventually contribute to human work 
experience. All human-machine systems perform under the directed influence of the human 
component’s tactics and strategies. 


Difficulties in Concept and Application 

One of the main difficulties of concept with human tactics and strategies is how to translate the 
abstract into something concrete akin to a system function, and then in a form through which it 
can be applied to human-machine system analysis. The first stage is to make the abstract 
tangible with respect to stages of job performance. 

ST AN AG 3994 mentions the use of ‘...a review of tasks in similar systems’. To be 
effective, such a review requires an in-depth examination of tasks, possibly using Subject 
Matter Experts (SMEs) and knowledge elicitation techniques 24 - The matters to be examined 
include: 

• Common problem areas requiring cognitive effort; i.e. the interpretation of sensor 
data, the determination of rates of change of data, the understanding of particular types 
of information. 

• The association of the common problem areas with jobs (i.e. tactics and strategies) or 
forms of task. 

• Any timing data that may be available; i.e. with this form of problem and that form of 
task, why does the operator take a certain time to gather evidence and to resolve the 
problem? 

• Any evidence that can be collected on how to ameliorate the operator’s cognitive 
effort, if deemed to be excessive. 

The two areas of operator applied cognition that should be investigated by the examination 

m \ The application of cognitive processes to the performance of a task or sub task. 

ii. The application of cognitive processes to progress tactics or strategies associated 
with a group of tasks or parts of a mission. 


23 Rasmussen’s SRK theory, the consideration of Skills, Rules and Knowledge based behaviour as determinants 
of human performance. See Rasmussen (1986). 

24 Knowledge elicit atio n techniques can be considered under 2 categories; Direct and Indirect methods. Direct 
methods are used where an expert can be asked directly to indicate their knowledge. Indirect methods are used to 
infer the experts knowledge from the experts performance at other or similar tasks to those on question. Direct 
methods include: Interviews, protocol analysis, Kelly grid, concept sorting. Indirect methods include ‘20 
Questions’ , concept recall and listing. Further reading includes Kidd (1987). 
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An Avenue Towards a New Method of Systems Design 

The efficacy of the common forms of the Fitts list must be questioned. If it is accepted that 
some essential human-machine system functions can be purely cognitive, then it is necessary to 
develop a method to identify these cognitive functions and their implications within the system 
design. Some considerations on an avenue to such a method are outlined in the remainder of 
this paragraph. 

Examination of similar systems. The initial action is to look at what systems have been used 
before for similar aircraft roles. This does not necessarily involve the examination of near 
identical jobs to those envisaged for the new system, though such an examination is preferable. 
It may be that there are no near identical jobs and that equivalent jobs will have to be used. For 
example, the operation of a collision avoidance Radar screen might give indications of 
problems that may be encountered in the operation of a weather avoidance Radar. 

From the initial action, a system (or systems) is chosen for further examination. Obviously, 
the greater the number of systems examined the better within the constraints of time and 
budget. 

The next stage is to use knowledge elicitation techniques, as appropriate and with the 
cooperation of suitable SMEs, to determine where the SMEs assess the greatest cognitive loads 
reside. To assist this process, the concepts of human tactics and strategies should be explained 
as well as the equipment and tasks being considered . 25 It is important that a series of tasks is 
considered in order that both tactics and strategies can be properly addressed. If possible, the 
questioning of an SME during the operation of an aircraft system or simulator is preferable. If 
actual equipment of some form is not available, some form of task analytic simulation might 
suffice provided the SME is well acquainted with the form of task representation used. It must 
be accepted that there is no current method of ensuring that all system critical cognitive 
processes may be examined. 

A novel method of assessing human problems and capabilities associated with flight is 
allowed by the ‘MicroPaf tool as developed by Bartram et al at Hull University (bought by 
some UK military agencies and Cathy Pacific Airlines). This tool was designed to perform 
psychometric assessment of aircrew candidates using dynamic simulations of the standard 
functions of aircrew systems. It is suggested that this tool, or another of the same form, could 
be used alongside knowledge elicitation techniques as a means of determining and assessing 
broad categories of aircrew cognitive functions associated with generic equipment functions of 
aircrew systems (i.e. combination of the human usage of artificial horizon, altimeter and 
heading reference 26 ). 

It is suggested that the elicitation of knowledge in the task related area will be easier than the 
elicitation of knowledge on tactics and strategies; a task normally being performed under 
operator focused attention whereas an operator’s consideration on a tactic or strategy may not 
necessarily be continuous and may be resident in non declarative memory. Considering verbal 
protocols as an example of a task elicitation technique, concurrent and retrospective protocols 
may both be suitable to gain a fair indication of a task related use of cognition. However, to 


25 The SMEs use of tactics and strategies, both mental and in the material / militaristic sense, was approached 
in Macleod et al (1993) during the process of the predictive examination of workload for the RN Merlin. This 
study also included an examination on the effects of operator errors and decision processes on system tactical 
performance. 

26 An example is a tool produced to assess candidate aircrew’s ability to perform mental navigation calculations 
whilst flying a simple computer based aircraft simulator. See Bartram (1988). 
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elicitate information not in immediate memory (i.e. strategies) might require some form of 
prompting or the use of several knowledge elicitation methods. 

The examination of the verbal protocols must be based on a model and some decided 
categories of cognition. The question on whether verbal reports are or are not epiphenomenal is 
a subject of continued debate that will not be addressed here . 27 The concern here must be the 
benefit that any method brings to the final application compared to the benefits possible from 
other methods. Considering the inadequacies of the traditional approach, it is suggested that 
even a classification of human-machine system tasks as requiring associated operator cognitive 
processes of a ‘High/Medium/ Low’ nature is better than no consideration at all. 

Once an early understanding is obtained on the operators use of cognition or cognitive 
functionality, task related use of cognitive functionality should be considered alongside the 
chosen system’s equipment functions embedded in that task. Where any association of 
cognitive and equipment functions is not possible, but the equipment function is understood, 
each form of function should be specifically labelled as a task related equipment function e.g. 
lower undercarriage. Where a task related function is deemed to be purely cognitive it should be 
labelled as a task related cognitive function (e.g. assess visibility). Where task related 
equipment and cognitive functions must be associated, their association should be labelled as a 
specific task related associated function (e.g. determine position on glide-slope of airfield 
approach). Any cognitive functionality that cannot be related to a task, but to a series of tasks or 
a tactic or a precess, should also be considered as a specific system cognitive function and 
labelled (e.g consider tactics to be applied to surveillance of manoeuvering target). 

Appreciation within the new system design. The next step should be to apply the data on 
cognitive processes obtained from the examination of similar systems as outlined above. The 
difficulties in determining and incorporation values of cognition into the system life-cycle 
design processes are considerable. To strive for the synergy necessary for a complex human- 
machine system, Cognitive Task Analysis techniques will be applicable here. 

The method of incorporation human cognition into system design requires a detailed system 
functional and process analysis process, probably using a form of dynamic modelling 
technique. This technique to examine and combine the required and refined functionality of the 
new system with that obtained from the examination of similar systems. 

The knowledge gleaned in this fashion could then be checked and further refined through 
the use of flight/air mission prototypes, mockups and simulators. Of course, the ideal scenario 
would be to continue the refinement process using data collected from actual aircraft equipment 
and flight prototype trials. 

Whatever method is used, a careful consideration of cognition will require an iterative 
process in the early stages of the system analysis process. This iterative examination is seen as 
essential to consider and amalgamate the information gleaned from old systems (i.e. cognitive 
tactics and manifest operating procedures) with the detailed functionality and expected 
performance of new equipment. 

Valid basics for the understanding of cognitive functionality can only be determined through 
practice in investigation and application. What is eventually required for the system designer is 
a set of ‘rules of thumb’ through which the subject of human cognitive functionality can be 
effectively approached within the realms of system design as a whole. 

It is easy to pay lip service to theory and say that equipment should be built to appreciate the 
human and the human trained to appreciate the machine. The basis of such mutual appreciation 


27 For detailed coverage of the debate see Ericsson & Simon (1984) and Nisbett & Wilson ( 1977). 
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must be a better practical understanding of human cognition as applicable to advanced aircrew 
systems. However, such an understanding will involve a great deal of experimentation, 
preferably in the field rather than the laboratory, and an education of system designers to 
convince them that such an effort is necessary. 



Figure 3. The Remit of Cognitive Task Analysis 

It is suggested that a careful appreciation of cognition within the specification of the 
functionality for a new system should allow improvements in the following: 

• The determination of Necessary and Accessory Functionality. 

• The initial assessment of the numbers and quality of personnel required to operate the 
system. 

• The assessment during system design of the form of operator training required. 

• The production and progression of a HEPP for the new system. 

• The design of the system HMI / HCI. 

• The efficiency of trade-off process during system design. 

• The creation of formal operating or tactical procedures. 

• The assessment of achievable system performance and the risk inherent in the design. 
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Summary and Conclusion 


This paper has examined the requirements of HF specification and certification within advanced 
or complex aircrew systems. It suggests reasons for current inadequacies in the use of HF in 
the design process, giving some examples in support, and suggest an avenue towards the 
improvement of the HF certification process. The importance of human cognition to the 
operation and performance of advanced aircrew systems has been stressed. Many of the 
shortfalls of advanced aircrew systems must be attributed to over automated designs that show 
little consideration on either the mental limits or the cognitive capabilities of the human system 
component. 

Traditional approaches to system design and HF certification are set within an over 
physicalistic foundation. Also, traditionally it was assumed that physicalistic system functions 
could be attributed to either the human or the machine on a one to one basis. Moreover, any 
problems associated with the parallel needs, of promoting human understanding alongside 
system operation and direction, were generally equated in reality by the natural flexibility and 
adaptability of human skills. 

The consideration of the human component of a complex system is seen as being primarily 
based on manifestations of human behaviour to the almost total exclusion of any appreciation of 
unobservable human mental and cognitive processes. The argument of this paper is that the 
considered functionality of any complex human-machine system must contain functions that are 
purely human and purely cognitive. Figure 3 indicates the place of Cognitive Task Analysis as 
an aid to this process. Human-machine system reliability ultimately depends on human 
reliability and dependability and, therefore, on the form and frequency of cognitive processes 
that have to be conducted to support system performance. The greater the demand placed by an 
advanced aircraft system on the human component’s basic knowledge processes or cognition, 
rather than on their skill, the more insiduous the effects the human may have on that system. 

This paper discussed one example of an attempt to devise an improved method of 
specification and certification with relation to the advanced aircrew system, that of the RN 
Merlin helicopter. The method is realised to have limitations in practice, these mainly 
associated with the late production of the system specification in relation to the system 
development process. 

The need for a careful appreciation of the capabilities and support needs of human cognition 
within the design process of a complex man machine system has been argued, especially with 
relation to the concept of system functionality. Unlike the physicalistic Fitts list, a new 
classification of system functionality is proposed, namely: 

• Equipment. System equipment related. 

• Cognitive. Human cognition related. 

• Associated. Necessary combination of equipment and cognitive. 

This paper has not proposed a method for a fuller consideration of cognition within systems 
design, but has suggested the need for such a method and indicated an avenue towards its 
development. Finally, the HF certification of advanced aircrew systems is seen as only being 
possible in a qualified sense until the important functions of human cognition are considered 
within the system design process. 

(This paper contains the opinions of its authors and does not necessarily reflect the standpoint 
of their respective organisations). 


Does Human Cognition Allow Human Factors (HF) Certification... 


185 


References 


Ackoff, R.L. (1972) Science in the systems age: Beyond IE, OR and MS. Address to the 
Operations Research Society of America, Atlantic City, New Jersey. 

Adler, A. (1929) Individual Psychology. London. 

Bainbridge, L. (1987), Ironies of automation. In: New Technology and Human Error , 
Rasmussen, J., Duncan, K. & Leplat, J (Eds). John Wiley & Sons. 

Bartlett, F.C., (1932) Remembering: A study in experimental and social psychology. Allen & 
Unwin. 

Bartram, D. (1988). Development of computerised test of aircrew navigation ability , paper 
presented to the British Psychological Society Occupational Psychology Conference, 
University of Manchester. 

Card, S.K., Moran, T.P. & Newell, A. (1983) The psychology of human computer interaction 
Lawrence Erlbaum Associates. 

Craik, K.J.W. (1943). The nature of explanation. Cambridge. 

Department of Defence. (1991). Defence Acquisition Management Policies and Procedures. 
Department of Defence Instruction 5000.2. Washington, DC: Office of the Secretary of 
Defence. 

Ericsson, K.A. & Simon, H.A. (1984) Protocol analysis. Verbal reports as data, The MTT 
Press. 

Hollnagel, E. (1983), What we do not know about man-machine systems. International Journal 
of Man-Machine Studies, 18, pps 135-143. 

James, W (1890). Principles of Psychology. New York. 

Kidd, A.L. (Ed) (1987). Knowledge acquisition for expert systems: A practical handbook , 
Plenum Press. 

MacLeod, I.S., Biggin, K., Romans, J. & Kirby, K. (1993) Predictive Workload Analysis - 
RN EH101 Helicopter, Contemporary Ergonomics. Taylor and Francis. 

Meister, D. (1985) Behavioural analysis and measurement methods. John Wiley and Sons. 

Miles, J.L. (1993). TASK Analysis - Foundation for Modem Technology. Presented at MRC 
Workshop on Task Analysis, University of Warwick,, G.B. 

NATO Standardisation Agreement (STANAG) - STANAG 3994AI First Draft. The 
Application of Human Engineering to Advanced Aircrew Systems.. 

Neisser, U. (1976) Cognition and reality: principles and implications of cognitive psychology , 
San Francisco. 

Nisbett, R.E. & Wilson, T.D. (1977) Telling more than we can know: Verbal reports on 
mental processes, Psychological Review , 84, pps 231-259. 

Price, H.E. (1985). The allocation of functions in systems. Human Factors , 27(1), pps 33-45. 

Price, H.E. & Pulliam, R. (1988). Functional analysis and allocation of functions. In: 

Helander, M. (Ed) Handbook of Human- Computer Interaction. Elsevier, North-Holland, 
pp641. 

Rasmussen, J. (1986) Information Processing and Human Machine Interaction Elsevier, New 
York. 

Reason, J.T. (1990) Human Error , Cambridge University Press. 

Schank, R.C. & Abelson, R.P. Scripts, plans and knowledge. Proceedings of the fourth 
international joint conference on artificial intelligence. Tbilisi. 



186 


MacLeod & Taylor 


Taylor, R.M. (1993) Human Factors of Mission Planning Systems : Theory and Concepts , 
NATO AGARD AVP Lecture Series 192, (In press). 

Taylor, R.M. & MacLeod, I.S. (1993), Quality Assurance and Risk management. 

Perspectives on Human Factors Certification of Advanced Aviation Systems , Proceedings 
of the Workshop on Human Factors Certification of Advanced Aviation Technologies, 
Toulouse, France, 19-23 July (In Press). 

Tversky, A. & Kahneman, D. (1974), Judgement under uncertainty: heuristics and biases, 
Science , 1 85, pps 1124-1131. 

UK Directorate of EH101, MoD. (PE) Merlin Prime Contract , MPC Specification Number: 
D/EH 10 1/2/90, 1990. 

UK Defence Standard 00-25. (1989), Human Factors for Designers of Equipment. Part 12: 
Systems, Issue 1, dated 15 July 1989. 

Welford, A.T. (1976). Skilled Performance: Perceptual and Motor Skills, Scott Foresman 

Wiener, E.L. (1985). Beyond the sterile cockpit, Human Factors , 27(1), pp 87. 

Woods, D.D. & Roth, E.M. (1988). Cognitive Systems Engineering. In: Helander, M. (Ed) 
Handbook of Human-Computer Interaction. Elsevier, North-Holland, pp 16. 


